Facebook expects to pay up to $5 billion for privacy breaches

In this March 28, 2018, file photo, a visitor poses for a photo with the Facebook logo reflected on her sunglasses at the company’s headquarters in Menlo Park, Calif. (AP Photo/Marcio Jose Sanchez, File)

Facebook said it expects a fine of up to $5 billion from the Federal Trade Commission, which is investigating whether the social network violated its users’ privacy.

The company set aside $3 billion in its quarterly earnings report Wednesday as a contingency against the possible penalty but noted that the “matter remains unresolved.”

The one-time charge slashed Facebook’s first-quarter net income considerably, although revenue grew by 25% in the period. The FTC has been looking into whether Facebook broke its own 2011 agreement promising to protect user privacy.

Investors shrugged off the charge and sent the company’s stock up more than 9% to almost $200 in after-hours trading. EMarketer analyst Debra Aho Williamson, however, called it a “significant development” and noted that any settlement is likely to go beyond a mere dollar amount.

“(Any) settlement with the FTC may impact the ways advertisers can use the platform in the future,” she said.

Facebook has had several high-profile privacy lapses in the past couple of years. The FTC has been looking into Facebook’s involvement with the data-mining firm Cambridge Analytica scandal since last March. That company accessed the data of as many as 87 million Facebook users without their consent.

The 2011 FTC agreement bound Facebook to a 20-year privacy commitment; violations could subject Facebook to fines of $41,484 per violation per user per day. The agreement requires that Facebook’s users give “affirmative express consent” any time that data they haven’t made public is shared with a third party.

The now-defunct Cambridge Analytica, which provided political data services to the 2016 Trump campaign and others, had wide access to normally private user data. It exploited a Facebook loophole that allowed it to see the data of people’s friends, and not just people who explicitly permitted access when they took a personality quiz. While Facebook did have controls in place that allowed people to restrict such access, they are found buried in the site’s settings and are difficult to find.

In addition to the FTC investigation, Facebook faces several others in the U.S. and Europe, including one from the Irish Data Protection Commission , and others in Belgium and Germany . Ireland is Facebook’s lead privacy regulator for Europe. The FTC is also reportedly looking into how it might hold CEO Mark Zuckerberg accountable for the company’s privacy lapses.

The social network said its net income was $2.43 billion, or 85 cents per share in the January-March period. That’s down 51% from $4.99 billion, or $1.69 per share, a year earlier, largely as a result of the $3 billion charge.